FROM elastic/filebeat:7.17.9

USER root

RUN sed -i '10,13d' /usr/share/filebeat/filebeat.yml \
    && sed -i '$a output.logstash:' /usr/share/filebeat/filebeat.yml \
    && sed -i '$a \  hosts: ["${DATAKIT_HOST}:5044"]' /usr/share/filebeat/filebeat.yml \
    && echo "" >> /usr/share/filebeat/filebeat.yml \
    && sed -i '$a filebeat.inputs:' /usr/share/filebeat/filebeat.yml \
    && sed -i '$a - type: filestream' /usr/share/filebeat/filebeat.yml \
    && sed -i '$a \  id: my-filestream-id' /usr/share/filebeat/filebeat.yml \
    && sed -i '$a \  enabled: true' /usr/share/filebeat/filebeat.yml \
    && sed -i '$a \  paths:' /usr/share/filebeat/filebeat.yml \
    && sed -i '$a \    - /var/log/*.log' /usr/share/filebeat/filebeat.yml

USER filebeat
